diff --git a/app/lib/auth.server.ts b/app/lib/auth.server.ts index 418f890..e1e7066 100644 --- a/app/lib/auth.server.ts +++ b/app/lib/auth.server.ts @@ -1,6 +1,8 @@ export async function requireAdmin(request: Request) { - // Simple fallback: check x-admin-token header vs ADMIN_TOKEN + // If ADMIN_TOKEN is not set, allow access (dev mode) + if (!process.env.ADMIN_TOKEN) return; + // Otherwise check the x-admin-token header const token = request.headers.get('x-admin-token'); - if (process.env.ADMIN_TOKEN && token === process.env.ADMIN_TOKEN) return; + if (token === process.env.ADMIN_TOKEN) return; throw new Response('Unauthorized', { status: 401 }); } diff --git a/app/routes/analyze.tsx b/app/routes/analyze.tsx index 3492c16..3b1dbe2 100644 --- a/app/routes/analyze.tsx +++ b/app/routes/analyze.tsx @@ -354,6 +354,7 @@ export default function Analyze() { const stock = stocks.find((s) => s.id === id); if (!stock) return; + // Only delete from DB if it was manually added (db- prefix), not Alpaca positions if (id.startsWith("db-")) { try { const formData = new FormData(); diff --git a/docs/superpowers/specs/2026-05-16-settings-page-redesign.md b/docs/superpowers/specs/2026-05-16-settings-page-redesign.md index f6e3b80..b56110b 100644 --- a/docs/superpowers/specs/2026-05-16-settings-page-redesign.md +++ b/docs/superpowers/specs/2026-05-16-settings-page-redesign.md @@ -18,7 +18,7 @@ Replace the current bare-bones settings page (a flat list of JSON textareas) wit - `trading.stopLossPercent` - number - `trading.riskMethod` - string ("fixed" | "percentage" | "atr") - **Saves** via `PUT /api/admin/settings/:key` with optimistic UI update -- **Stock notes** saved via `POST /api/stocks` with ticker + notes +- **Stock notes** saved via `POST /api/stocks` with FormData: `{ ticker, notes }` - **Loading state** shown while initial fetch completes ### Layout @@ -48,7 +48,7 @@ Replace the current bare-bones settings page (a flat list of JSON textareas) wit - Pagination if >20 stocks ### System -- Alpaca mode indicator (paper/live) - read-only, derived from env +- Alpaca mode indicator (paper/live) - read-only, fetched from `/api/alpaca/account` or derived from `ALPACA_BASE_URL` env var - Admin token management - Fallback JSON textarea for any raw `AppSetting` keys not covered above diff --git a/playwright-report/index.html b/playwright-report/index.html index 0a0ddc4..88098d3 100644 --- a/playwright-report/index.html +++ b/playwright-report/index.html @@ -87,4 +87,4 @@ Error generating stack: `+l.message+`
- \ No newline at end of file + \ No newline at end of file diff --git a/prisma/dev.db b/prisma/dev.db index fce1f88..eb13a26 100644 Binary files a/prisma/dev.db and b/prisma/dev.db differ